MusiCurate App Privacy Policy
Last updated July 29, 2026. Effective July 29, 2026.
This policy covers the MusiCurate mobile app. For purchases from our online store, see the store privacy policy. Une version française complète et équivalente est offerte au lien ci-dessus.
MusiCurate is built local-first and ad-free. This policy explains what the app stores, what leaves your device and the choices you have.
The short version
Your learning happens primarily on your device. If you create an account, selected progress and account features sync. We do not show ads, use third-party advertising trackers or sell your data.
Who we are
MusiCurate (“we”, “us”) is provided by MusiCurate Inc., a corporation incorporated in Alberta, Canada. We are accountable for personal information under our control and our privacy officer oversees that responsibility. Reach us at music@musicurate.com or by mail at MusiCurate Inc., PO Box 23168, Grande Prairie, Alberta T8V 6X2, Canada.
Information you give us
A birth year when you first set up the app; account details if you create an account; a display name and avatar choice if you create a profile; imported sheet music or images; messages, inquiries and support requests; and information you choose to place in credential evidence or appeals.
Learning and credential information
Learning data can include practice records, course progress, game and scale results, play history, annotations and preferences. Credential data can include verified lesson attempts, randomized assessment results, server-scored aural or conducting activities, structured plans and fieldwork records, teacher attestations, integrity signals, appeals, issuance history and revocation history. Credential evidence is used only to evaluate and support MusiCurate course credentials and related teacher-directory placement.
Credential evidence limits
Do not include identity documents, medical information, financial information, private student diagnoses or unnecessary identifying details in credential evidence. Use a learner description or initials where possible. MusiCurate credentials are course and evidence badges, not identity verification, professional licences, university credit, background checks or guarantees of teaching effectiveness.
Credential evidence retention
One-time credential activity attempts are normally retained for up to 90 days. Structured evidence content is normally retained for three years, then redacted while the minimal issuance and audit record may remain. Integrity events are normally retained for two years. Credential issuance and revocation history may remain while the account or an audit, security or legal requirement remains active.
Teacher attestations
When a teacher attests a performance or fieldwork record, we record the teacher account, current class relationship, observation, score or decision, and timestamp. The learner and authorized support staff may use this information to understand the credential decision. False or mistaken attestations can be appealed, invalidated or corrected.
Information collected automatically
We keep this minimal. Content and instrument-sound requests create ordinary server logs such as IP address, device information and timestamps. Security and credential systems also create limited integrity events for replay attempts, invalid submissions or implausible completion patterns. The app contains no third-party advertising, attribution or tracking SDKs. The optional “Share anonymous usage” setting sends anonymous play counts we use to pay composers fairly; you can turn it off any time in Settings.
Device permissions
Camera and Photos are requested only when you scan or import. Notifications are requested only for reminders. Microphone access is requested only for features that listen to playing. You can change permissions in device settings.
Embedded media in Listen
The Listen feature can embed YouTube, Spotify and Apple Music players. Those providers may process data under their own policies when you load or play their content.
Purchases
Subscriptions are processed by the Apple App Store or Google Play and, where enabled, a billing provider. We receive entitlement status but not payment-card details.
How we use information
To provide and sync the app; evaluate learning and credential requirements; issue, display, correct or revoke credentials; support teacher and learner relationships; process purchases; respond to support and appeals; keep the service secure; and meet legal obligations. Where the European Union or United Kingdom GDPR applies, we rely on performance of a contract (providing the app and your account), legitimate interests (security, service integrity and improvement), consent (optional features such as anonymous usage sharing and notifications) and legal obligation.
When information is shared
We do not sell data or share it with advertisers. We use service providers such as Supabase for account, database and content hosting, under contracts that limit their use of your information to providing services to us. Credential evidence is visible only to the learner, a current teacher when an attestation is required, and authorized support staff. Public profiles show only the credential badge and description, not the submitted evidence. We may disclose information where the law requires it.
Where your information is processed
Your information is processed in Canada and in countries where our service providers operate, including the United States. When information leaves Canada it remains protected by contract to a comparable standard, and it may be subject to lawful access by authorities in those countries. Where the GDPR applies, we use recognized transfer safeguards such as standard contractual clauses.
Children and teens
The minimum age to use MusiCurate is 13 and the app is not directed to children under 13. Protections apply to users aged 13 to 17: their showcase can never be public or searchable, they do not appear on public leaderboards and discovery is off. We collect a birth year to apply these protections, and we seek consent in a form appropriate to a young person’s maturity, consistent with Canadian privacy guidance. Teachers and learners must not place unnecessary identifying information about minors in credential evidence.
Keeping and deleting your data
Device data remains until deleted or the app is removed. Account data remains while the account is active and according to the retention periods above. “Delete all my data” in Settings removes or anonymizes personal data on this device and, if you are signed in, on our servers, subject to security, audit and legal retention needs. Credential appeals can be used to request correction before deletion.
Your rights and choices
MusiCurate Inc. handles personal information under the Personal Information Protection and Electronic Documents Act and Alberta’s Personal Information Protection Act. Depending on where you live, you may also have rights under Quebec’s private-sector privacy law, the European Union or United Kingdom GDPR or a United States state privacy law. You can ask to access, correct, delete or receive a copy of your personal information, withdraw consent for optional features or object to certain processing. Export and deletion tools are built into Settings, and you can email music@musicurate.com for anything else; we may need to verify your identity and we respond within the time your law requires (normally 30 days in Canada). If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta or your local supervisory authority.
Security
We use access controls, row-level security, one-time attempts, private answer keys, scoped server functions and audit trails. No system is perfectly secure.
Changes to this policy
We may update this policy as the app evolves and will highlight material changes before they take effect.
Contact
Questions about privacy or credential records? Email music@musicurate.com or write to MusiCurate Inc., PO Box 23168, Grande Prairie, Alberta T8V 6X2, Canada.